wauclt.exe

I realised this was taking a lot of time and memory at start up and did some
checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

On Nov 7, 4:19*am, "John" wrote:
I realised this was taking a lot of time and memory at start up and did some
checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 *- twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

Do you mean wuauclt.exe?

wuauclt.exe is part of the Windows Automatic Update Client and is
normally configured as the Automatic Updates service that runs
automatically under one of your svchost.exe Processes that you see in
Task manager.

You can download Process Explorer to determine which svchost is
running wuauclt.exe if you are interested in that:

http://technet.microsoft.com/en-us/s.../bb896653.aspx

How did you realize that it was taking a lot of time and memory at
startup?

In a general configuration, there should be no wauclt1.exe in system32
or dllcache. If there is, something may have gone wrrong somewhere
along the way, some kind of reinstall or your system is afflicted with
malicious software.

If Process Explorer says wuauclt1.exe is running, that is not normal.

There is probably a reference to wuauclt.exe...pf in the prefetch
folder and that is fine.

I do not have the ERDT folder, but depending on your system history
and what you have installed, you might.

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpywa (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

"Jose" wrote in message
...
On Nov 7, 4:19 am, "John" wrote:
I realised this was taking a lot of time and memory at start up and did
some
checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

Do you mean wuauclt.exe?

wuauclt.exe is part of the Windows Automatic Update Client and is
normally configured as the Automatic Updates service that runs
automatically under one of your svchost.exe Processes that you see in
Task manager.

You can download Process Explorer to determine which svchost is
running wuauclt.exe if you are interested in that:

http://technet.microsoft.com/en-us/s.../bb896653.aspx

How did you realize that it was taking a lot of time and memory at
startup?

In a general configuration, there should be no wauclt1.exe in system32
or dllcache. If there is, something may have gone wrrong somewhere
along the way, some kind of reinstall or your system is afflicted with
malicious software.

If Process Explorer says wuauclt1.exe is running, that is not normal.

There is probably a reference to wuauclt.exe...pf in the prefetch
folder and that is fine.

I do not have the ERDT folder, but depending on your system history
and what you have installed, you might.

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpywa (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

Thanks Jose. Yes - wuauclt.

I have malwarebytes and Process Explorer.

I noticed the programme running from Task Manager when I was checking to see
why there was a delay (after AVG had loaded) before I could start a
programme. wuauclt was one of them.
I have now removed some versions to a sentencing folder and the PC started
ok with the version in System32. Should I also remove the version with a "1"
in its name?

On Nov 7, 9:26*am, "John" wrote:
"Jose" wrote in message

...
On Nov 7, 4:19 am, "John" wrote:





I realised this was taking a lot of time and memory at start up and did
some
checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

Do you mean wuauclt.exe?

wuauclt.exe is part of the Windows Automatic Update Client and is
normally configured as the Automatic Updates service that runs
automatically under one of your svchost.exe Processes that you see in
Task manager.

You can download Process Explorer to determine which svchost is
running wuauclt.exe if you are interested in that:

http://technet.microsoft.com/en-us/s.../bb896653.aspx

How did you realize that it was taking a lot of time and memory at
startup?

In a general configuration, there should be no wauclt1.exe in system32
or dllcache. *If there is, something may have gone wrrong somewhere
along the way, some kind of reinstall or your system is afflicted with
malicious software.

If Process Explorer says wuauclt1.exe is running, that is not normal.

There is probably a reference to wuauclt.exe...pf in the prefetch
folder and that is fine.

I do not have the ERDT folder, but depending on your system history
and what you have installed, you might.

Perform some scans for malicious software first, then fix any
remaining issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): *http://malwarebytes.org/
SUPERAntiSpywa (SAS): *http://www.superantispyware.com/

They can be uninstalled later if desired.

Thanks Jose. Yes - wuauclt.

I have malwarebytes and Process Explorer.

I noticed the programme running from Task Manager when I was checking to see
why there was a delay (after AVG had loaded) before I could start a
programme. wuauclt was one of them.
I have now removed some versions to a sentencing folder and the PC started
ok with the version in System32. Should I also remove the version with a "1"
in its name?

I do not see wuauclt running in TM as a single process - it runs
"under" one of my svchost processses, which is how it should be. I
can only see it through Process Explorer.

If I stop the AU service and restart it, then wuauclt starts as its
own process and can be seen separately in TM but things go back to
normal when I reboot.

All this makes sense.

If you reboot your system, do you see wuauclt in TM as a separate
process?

I have no idea how you got some versions with "1", but it doesn't make
sense for something like that to be in system32 or dllcache. You
could sentence (move) them to some other folder and remove them from
system32 and dllcache - they do not belong there, reboot and then
troubleshoot any remaining issues.

When you are done poking around, reboot and make sure the AU service
is running and set to automatic in the Services applet:

%SystemRoot%\system32\services.msc /s

Then and see if wuauclt appears as a separate running Process in TM.

"John" wrote in message
...
I realised this was taking a lot of time and memory at start up and did
some checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the filename
ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the filename ie
wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

No, you should not. This is the Automatic Windows Update client, so
officially, it's "safe". However, it is not appropriate for it to run on
all systems or internet connections; if you are using dialup, for example,
or an older system, you do *not* want to allow this to run whenever it feels
like it. On some systems, the check for updates can effectively disable the
machine for five to ten minutes or more.

On such systems, it's a better idea to simply set Automatic Windows Update
to OFF. Then, reboot. The system will start faster; you will have to
make a practice of manually checking for updates. To do that, open
Internet Explorer, and under TOOLS, select WINDOWS UPDATE. Large updates,
such as XP SP3, should be downloaded using a faster system with a high-speed
connection, then burned to CD or copied to a flash drive, and installed
offline.

HTH

"Patrick Keenan" wrote in message
? ...

"John" wrote in message
...
I realised this was taking a lot of time and memory at start up and did
some checking around.
I have it in the following locations:

c:\windows\prefetch
c:\windows\system32 - twice - once with a "1" in the filename ie wauclt1
c:\windows\ERDT\cache
c:\windows\servicepackfiles\i386 - twice - once with a "1" in the
filename ie wauclt1
c:\windows\system32\dllcache -- twice - once with a "1" in the
filename ie wauclt1

Some date back to 2005.

Should I be concerned?

Should I remove any?

"Patrick Keenan" wrote:
No, you should not. This is the Automatic Windows Update client, so
officially, it's "safe". However, it is not appropriate for it to run
on all systems or internet connections; if you are using dialup, for
example, or an older system, you do *not* want to allow this to run
whenever it feels like it. On some systems, the check for updates can
effectively disable the machine for five to ten minutes or more.

Hi Patrick,

My system has never been disabled for even 1 second during a check. There
have been server delays on the other end, but I could continue doing
whatever else I wanted with the computer. Just because the dialup download
speed is slower doesn't mean other computer programs get sluggish either.

On such systems, it's a better idea to simply set Automatic Windows
Update to OFF. Then, reboot. The system will start faster; you will
have to make a practice of manually checking for updates. To do that,
open Internet Explorer, and under TOOLS, select WINDOWS UPDATE.
Large updates, such as XP SP3, should be downloaded using a faster
system with a high-speed connection, then burned to CD or copied to a
flash drive, and installed offline.

It is not a good idea to turn it off completely. With mine set to notify,
about 1/2 second cpu time is consumed once every 5 hours. That is totally
NOT a big deal! On another machine here with Home Edition and a processor
about half as fast, SP3 downloaded and installed without a glitch. You're
right that a high-speed connection for large files speeds up the process,
but with BITS (Background Intelligent Transfer Service) the downloads from
Windows Update can proceed gradually during idle time, without interfering
with other activities of the computer. When you download with a browser,
it downloads things while YOU wait, but AU with BITS, waits for you.

In the wuau.chm help file topic on "How does Automatic Updates work?" It
says: "It makes no difference whether you use a dial-up or broadband
connection; important updates are downloaded behind the scenes and do not
interfere with other downloads. If you disconnect from the Internet before
updates are fully downloaded, nothing is lost. The download process will
continue the next time you connect to the Internet."

Windows Update website:
http://update.microsoft.com/windowsu...6/default.aspx

How to read the Windowsupdate.log file
http://support.microsoft.com/kb/902093

HTH. (Hope This Helps.
--Richard

- - -
Special Veteran's Day Remembrance
http://www.avbtab.org/rc/veterans.htm